MCP Inspector below 0.14.1 allowed unauthenticated remote code execution, per GitHub advisory

Summary

GitHub advisory GHSA-7f8r-222p-6f5g (CVE-2025-49596, critical): @modelcontextprotocol/inspector below 0.14.1 is vulnerable to remote code execution because there is no authentication between the Inspector client and proxy, so unauthenticated requests can launch MCP commands over stdio. The advisory credits Tenable.

Techniques

Technique-level mapping, an editorial judgment made by the method.

• T1059 Command and Scripting Interpreter

MITRE ATT&CK technique IDs and names: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use

Controls

Controls that could prevent, detect, or support recovery from this kind of failure. Mappings are editorial judgments made by the method, not findings about what any party should have done.

NIST AI RMF

Not mapped. AI RMF mapping is optional for cyber incidents.

NIST SP 800-53

• AC-3 Access Enforcement
• CM-7 Least Functionality
• SC-7 Boundary Protection
• SI-2 Flaw Remediation

Human-approval (JCR) checkpoint

not applicable

Correlated incidents

Co-occurrence, not cause: each link records something the two incidents share, as its rationale and source state. It does not say one incident caused the other. Links are written on one record; the other record shows the same link marked derived.

• AI AIA-013 Cursor agent: writing MCP config files without approval enabled code execution (CVE-2025-54135), per Cursor advisory

  same technique

  Both involve MCP tooling leading to command execution: unauthenticated requests could launch MCP commands through the Inspector proxy, and Cursor's advisory describes agent-written MCP config files that enabled code execution.

  Source: github.com https://github.com/cursor/cursor/security/advisories/GHSA-4cxx-hrm3-49rm

• AI AIA-014 Cursor MCP one-time approval could be reused after config change (CVE-2025-54136, "MCPoison"), per Check Point Research

  same technique

  Both involve MCP tooling leading to command execution: unauthenticated requests could launch MCP commands through the Inspector proxy, and Check Point Research reports a changed, previously approved MCP config in Cursor could run commands.

  Source: research.checkpoint.com https://research.checkpoint.com/2025/cursor-vulnerability-mcpoison/

• Cyber CYB-008 mcp-remote exposed to OS command injection from untrusted MCP servers, per GitHub advisory

  same technique derived from CYB-008

  Both are MCP tooling flaws leading to command execution, per their GitHub advisories: missing authentication between the MCP Inspector client and proxy, and OS command injection in mcp-remote.

  Source: github.com https://github.com/advisories/GHSA-7f8r-222p-6f5g

Sources

• github.com primary link checked 2026-10-31, HTTP 200
  GHSA-7f8r-222p-6f5g; published Jun 13, 2025; rated critical; credit Tenable
  https://github.com/advisories/GHSA-7f8r-222p-6f5g

Corrections

No corrections recorded.

To report an error in this entry, see corrections.